[dead]
Distributing Mac software is increasing my cortisol levels
161–170 of 299 posts
Re: Distributing Mac software is increasing my cortisol levels
#1621 year ago i would have agreed with you. Today, I'm going to take the other side on this. The amount of malicious code embedded in software now is going up exponentially. Yes this is a painful tax imposed on all software, malicious or not, but until they figure out a better system, this system actually will disuade a certain percentage of malicious actors to give up - ESPECIALLY having to pay a fee. As a mac user, i…
There are many cases of signed & notarised software that pwned users.
Sure, but the more barriers there are the better because it still reduces the number of threats. That’s why people choose to rent walled gardens. Otherwise, Linux would have higher adoption even among our crowd.
If you really value freedom over everything else, I don’t see value in putting bad bandages over closed platforms. Might as well just switch to an open one.
Re: Distributing Mac software is increasing my cortisol levels
#163Any user who does not like Gatekeeper can turn it off on their machine in ten seconds by running this in a Terminal: sudo spctl —-master-disable People will say, no, that’s too big a hammer, it’s not safe… but then, like, what do you actually want? Either you keep Gatekeeper because you like the friction it introduces, or you don’t like that friction and you should go turn it off. Pick one, you obviously can’t have b…
> Any user who does not like Gatekeeper can turn it off on their machine in ten seconds by running this in a Terminal
For now. Enjoy it while it lasts.
Re: Distributing Mac software is increasing my cortisol levels
#164Maybe I'm too dumb, but I haven't figured out a good way to sign just a binary (or a tar/zip containing a few binaries). I zipped up the binaries, sent them off to Apple, Apple comes back and says "yup, notarized!", and they still trigger the popup. I'm probably missing a step. I guess I'm not currently stapling the ticket to the binary, but supposedly you don't have to if you are running with a network connection.
Theres two different steps, there is signing and there is notarization. You sign with the developer certificate using productsign/codesign, and then there is notarization, which you use notarytool to submit your signed binaray to apple to notarize.
finally you then take their response and staple it to your binary. Its a lot of steps.
Re: Distributing Mac software is increasing my cortisol levels
#165I have been developing software for Macs and PCs as an Indie for 20 years now. I sympathize with the author of the post. You get the feeling that Apple thinks you should be grateful that they allow you to develop apps for their platform. The author didn't mention Apple's contempt for backward compatibility. Apple like to regularly nuke their entire developer system from orbit. Try running an app developed 10 years ag…
Honestly, I kind of support this lack of backward compatibility. So many apps I use from big companies are still Intel based and leaving tons of performance on the table. This will finally force them to change when Rosetta is deprecated. Open source apps are all native.
Mac used to have a lot of great shareware from indie devs. Some of them have shut down and their apps will eventually stop working. Kinda annoying when I can play the windows port of a game on windows but not the original Mac version
Re: Distributing Mac software is increasing my cortisol levels
#166Is there no open source collective one can join which will share signing keys and handle signing?
https://signpath.org/ is about as close as you can get.
Re: Distributing Mac software is increasing my cortisol levels
#167Earlier quoted context omitted.
This is that false dichotomy. You can turn off all protection, as you point out. So who Apple markets Neo's to isn't a factor. > Apple’s fault if nobody else decided to make their own trust repositories and the only alternative on the market is to have no safeguard at all. Does Apple provide a means for enabling third party trust systems, without disabling Apple's protections in general? If not, that is a serious pro…
If you can enable a third party trust system you completely open it up for abuse. If I put my threat actor hat on, I love your idea because now I have an alternative codepath to try and exploit (where you do store third-party trusted roots for code-signing/notarization evaluations that cannot be tampered with, how do you load them, verify them, etc), but now instead of having to dance around bypassing Gatekeeper, I c…
> If you don't trust Apple, why the hell are you buying their computers at all?
This is the exact same false dichotomy they mentioned; it's perfectly reasonable to have a set of trusted software vendors that includes Apple but also some others, while the only choices that they support are either just Apple or literally anyone in the universe. You're conflating "trusting Apple" with "trusting no one but Apple to make it sound like the opposite of the latter is somehow also contradictory with the former.
Claiming it's "not worth the effort" is a lot easier when you've already muddied the waters like this.
Re: Distributing Mac software is increasing my cortisol levels
#168If I am understanding this correctly, the $99/year Apple Developer Program allows you to notarize applications for macOS so users do not receive the warning/damaged binary dialog. I simply had AI generate the signing code, and you can run that script on any CICD or on your machine and push the artifacts to a CDN. Works wonderfully for macOS, and users of my app have had no issues with it.
Let me know by replying here if you want me to share the build+sign code or have any questions.
Re: Distributing Mac software is increasing my cortisol levels
#169Earlier quoted context omitted.
This is that false dichotomy. You can turn off all protection, as you point out. So who Apple markets Neo's to isn't a factor. > Apple’s fault if nobody else decided to make their own trust repositories and the only alternative on the market is to have no safeguard at all. Does Apple provide a means for enabling third party trust systems, without disabling Apple's protections in general? If not, that is a serious pro…
Sounds like you should pick something other than MacOS.
I decided to get into this subject in my comment before I edited it out because I thought it would be too much of a tangent/ruffle too many feathers.
But, yeah, macOS power users these days seem to spend a lot of time criticizing the OS and the company and never seem to just switch to something else.
Apple is the 4th most popular PC manufacturer on the market. You can use something else. It's not a monopoly, nor a duopoly like with iOS.
I switched to Linux, and I've been beyond shocked at how smooth it's been. It's been better than both Mac and Windows in more ways than I expected. And sure, not perfect, but still.
Re: Distributing Mac software is increasing my cortisol levels
#170Earlier quoted context omitted.
Sounds like you should pick something other than MacOS.
Right, all they need to do is convince every end user they’re trying to distribute software to that they’re using the wrong OS and should replace their MacBook with something running Linux. No problem at all.
Or Windows, the OS that is already vastly more popular than macOS.